Examkin

Question

Difficulty: MediumConfigure Network Security Groups (NSGs) and Application Security Groups (ASGs)

An administrator configures network security for a virtual machine named `VM1` in an Azure subscription. `VM1` is connected to a subnet named `SubnetA`. The network interface of `VM1` is associated with an Application Security Group (ASG) named `ASG-Web` and has an associated Network Security Group (NSG) named `NSG-NIC`. `SubnetA` has an associated NSG named `NSG-Subnet`.

`NSG-Subnet` contains the following inbound security rules:
* Priority 100: Allow inbound TCP traffic on port 80 from Any to `ASG-Web`
* Priority 200: Deny inbound TCP traffic on port 80 from Any to Any

`NSG-NIC` contains the following inbound security rules:
* Priority 150: Deny inbound TCP traffic on port 80 from Any to Any
* Priority 250: Allow inbound TCP traffic on port 80 from Any to `ASG-Web`

A user attempts to connect to `VM1` on port 80 from the internet.
What is the result of the connection attempt?

  1. A
    The connection is allowed because the rule with priority 100 in the subnet-level NSG allows the traffic, bypassing network interface-level checks.
  2. The connection is denied because the network interface-level NSG processes the deny rule with priority 150 before the allow rule with priority 250.Answer
  3. C
    The connection is allowed because the rule with priority 250 in the network interface-level NSG specifically targets the Application Security Group (ASG) of the destination.
  4. D
    The connection is denied because the subnet-level NSG processes the deny rule with priority 200 first, blocking the traffic before evaluating the network interface-level NSG.

Answer

The connection is denied because the network interface-level NSG processes the deny rule with priority 150 before the allow rule with priority 250.
For inbound traffic to a virtual machine in a subnet, Azure evaluates the inbound rules of the subnet-level NSG first, followed by the inbound rules of the network interface-level NSG. In this scenario, the subnet-level NSG allows the traffic because the rule with priority 100 is evaluated before priority 200. However, when the traffic reaches the network interface-level NSG (NSG-NIC), the rules are evaluated in priority order (lowest number first). The rule with priority 150 (Deny port 80) is processed before the rule with priority 250 (Allow port 80 to ASG-Web). Therefore, the network interface-level NSG denies the traffic, and the connection attempt fails.

Step-by-Step Solution

1
Evaluate the inbound traffic at the subnet level using NSG-Subnet.
The traffic is allowed by the rule with priority 100 because VM1 is associated with ASG-Web, and priority 100 has precedence over the deny rule at priority 200.
Inbound subnet NSG rules are evaluated first, and lower priority numbers take precedence.
2
Evaluate the inbound traffic at the network interface level using NSG-NIC.
The traffic matches the deny rule with priority 150 (Deny port 80 from Any to Any) which is evaluated before the allow rule at priority 250.
After passing the subnet NSG, inbound traffic is evaluated by the NIC NSG in priority order (lowest number first).
3
Determine the final connection outcome.
The connection attempt fails and is blocked.
For inbound traffic to succeed, it must be allowed by both the subnet-level NSG and the network interface-level NSG. Since the NIC-level NSG denied it, the final outcome is denied.

Key Concept

Azure evaluates both subnet-level and network interface-level NSGs in sequence for inbound traffic, and rules within each NSG are processed in priority order where lower numbers have higher precedence.
Rate this question

Topics

Configure Network Security Groups (NSGs) and Application Security Groups (ASGs)